Referring to the below inputs.conf for one of my windows server , as you can see, there is some whitespace at the end of the first line before the closing bracket. The "folderA" is the folder where the contents, splunk should be ingesting but is not (there are multiple log files inside). Is there a possibility that because of this whitespace Splunk may not be ingesting the logs? And if yes, any explanation on this so that we can explain/advise to the client.
"
[monitor://C:\Program Files\somepath\folderA ] index=someindex sourcetype=somesourcetype
"
Hi @YJ,
please try this:
[monitor://C:\Program Files\somepath\folderA*\*]
index=someindex
sourcetype=somesourcetype
Ciao.
Giuseppe